Disable collecting or viewing Windows OS file systems from a SSM managed on-prem windows server

Consider this for Restrict File System & User Visibility:

1. Disable Inventory Collection Check if the instance is part of an Inventory association: • Go to Systems Manager → Inventory → Managed Instances • Remove the instance from any inventory collection schedules. • Alternatively, use ssm:UpdateInstanceInformation deny policy to block metadata updates.

2. Restrict Fleet Manager Access via IAM Create a deny policy that explicitly blocks Fleet Manager actions:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": [
        "ssm:StartSession",
        "ssm:GetInventory",
        "ssm:DescribeInstanceInformation",
        "ssm:DescribeDocument",
        "ssm:GetDocument"
      ],
      "Resource": "*"
    }
  ]
}

Attach this to IAM users or roles that should not view file system or user data.

3. Limit Document Execution Scope

• Denying ssm:SendCommand for AWS-GatherSoftwareInventory, AWSFleetManager-*, and AWS-RunPowerShellScript if not needed. • Use resource-level conditions to allow only your custom documents.

To Restricting the ability to view or update file systems from the AWS console or Fleet Manager. Here are the steps I followed:

1. I have created an IAM role in my account with admin permissions in the trust relationship.
2. I have added the "AmazonEC2FullAccess," "AmazonSSMFullAccess," and "AmazonSSMManagedInstanceCore" policies to the role.
3. I created a customer-managed policy with the following content and attached it to the role:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Deny",
            "Action": [
                "ssm:SendCommand"
            ],
            "Resource": [
                "arn:aws:ssm:*:*:document/AWSFleetManager-*",
                "arn:aws:ssm:*:*:document/AWS-GatherSoftwareInventory"
            ]
        }
    ]
}

4. After switching to the new IAM role, I was unable to view the file systems and Users and Groups in the Systems Manager console (Fleet Manager).

I received the following error: "You don't have permission to use Run Command. An IAM policy with SSM SendCommand and SSM GetCommandInvocation privileges is required."

About AWSServiceRoleForAmazonSSM service role.

This role is automatically created and used by various Systems Manager tools and components, including the Inventory tool for collecting metadata from tags and resource groups, and the Explorer tool for viewing OpsData and OpsItems across multiple accounts.

For more information about AWSServiceRoleForAmazonSSM see below docs[1].

[1] https://docs.aws.amazon.com/systems-manager/latest/userguide/using-service-linked-roles-service-action-1.html

I cannot deny "ssm:GetDocument" for all resources as I have custom document that requires this action to perform. I cannot deny AWS-RunPowerShellScript as I need it for my custom documents. I have created poilcy to deny all ssm actions by the resources AWS-GatherSoftwareInventory, AWSFleetManager-, but I am still able to view the file systems and create directories. For the time being, I have implemented a workaround with limitation where I have assigned a specific admin user to govern the amazon ssm agent windows service and I have locally denied the specific user to access the required folders. While troubleshooting, I found a service linked role AWSServiceRoleForAmazonSSM existed and I see certain activities by this role where I have never used this role at all. Does the fleet manager internally use this role to execute AWSFleetManager- document and that is why the policy is not getting executed when I am clicking File System in Fleet Manager? I am just guessing and not sure about it.